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Get Started 


Continuous Monitoring API 


Download information from the Continuous Monitoring module when this is 
module enabled in your Qualys account. Get information about alerts, profiles, 
rules and rulesets. 


Modules supported 
CM 
Authentication 


Authentication to your Qualys account with valid Qualys credentials is 
required for making Qualys API requests to the Qualys API servers. Learn 


more about authentication to your Qualys account 
Get API Notifications 


We recommend you join our Community and subscribe to our API 
Notifications RSS Feeds for announcements and discussions. 


https://community.qualys.com/community/developer/notifications-api 


About Qualys 


Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud- 
based security and compliance solutions. The Qualys Cloud Platform and its 
integrated Cloud Apps deliver businesses critical security intelligence 
continuously, enabling them to automate the full spectrum of auditing, 
compliance and protection for IT systems and web applications on premises, 
on endpoints and elastic clouds. For more information, please visit 
www.qualys.com 


Qualys and the Qualys logo are proprietary trademarks of Qualys, Inc. All 
other products or names may be trademarks of their respective companies. 
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Qualys user account 


The application must authenticate using Qualys account credentials (user 
name and password) as part of the HTTP request. The credentials are 
transmitted using the “Basic Authentication Scheme” over HTTPS. 


For more information, see the “Basic Authentication Scheme” section of RFC 
#2617: 


http://www.fags.org/rfcs/rfc2617.html 


The exact method of implementing authentication will vary according to 
which programming language is used. 


Basic authentication - recommended option: 


curl -u "USERNAME:PASSWORD" 
https://qualysapi.qualys.com/qps/rest/1.0/download/cm/alert 


where qualysapi.qualys.com is the base URL to the Qualys API server where 
your account is located. 
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URL to Qualys API server 


The Qualys API URL you should use for API requests depends on the Qualys 
platform where your account is located. 


Click here to identify your Qualys platform and get the API URL 


This documentation uses the API server URL for Qualys US Platform 1 
(https://qualysapi.qualys.com) in sample API requests. If you're on another 
platform, please replace this URL with the appropriate server URL for your 
account. 
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Making API calls 


Curl samples in our API doc 


We use curl in our API documentation to show an example how to form REST 
API calls, and it is not meant to be an actual production example of 
implementation. 


GET and POST Methods 


Qualys API functions allow API users to submit parameters (name=value 
pairs) using the GET and/or POST method. There are known limits for the 
amount of data that can be sent using the GET method, and these limits are 
dependent on the toolkit used. Please refer to the individual descriptions of 
the API function calls to learn about the supported methods for each function. 


Parameters in URLs 


API parameters, as documented in this online help, should be specified one 
time for each URL. In the case where the same parameter is specified multiple 
times in a single URL, the last parameter takes effect and the previous 
instances are silently ignored. URL elements are case-sensitive. 


Date format in API Results 


The Qualys API has adopted a date/time format to provide consistency and 
interoperability of the Qualys API with third-party applications. The date 
format follows standards published in RFC 3339 and ISO 8601, and applies 
throughout the Qualys API. The date format is: yyyy-mm-dd[Thh-mm-ssZ]. 
This represents a UTC value (GMT time zone). 


URL encoding in API Code 


You must URL encode variables when using the Qualys API. This is standard 
practice for HTTP communications. If your application passes special 
characters, like the single quote (), parentheses, and symbols, they must be 
URL encoded. For example, the pound (#) character cannot be used as an 
input parameter in URLs. If “#” is specified, the Qualys API returns an error. To 
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specify the “#” character in a URL you must enter the encoded value “%23”. 
The “#” character is considered by browsers and other Internet tools as a 
separator between the URL and the results page, so whatever follows an un- 
encoded “#” character is not passed to the Qualys API server and returns an 
error. 


Making requests with URL payload 

While it is still possible to create simple API requests using the GET method, 
you can create API requests using the POST method with an XML payload to 
make an advanced request. 

The XML payloads can be compared to a scripting language that allows user 
to make multiple actions within one single API request, like adding a 


parameter to an object and updating another parameter. 


The XML structure of the payload is described in the XSD files. 
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Know your portal version 
/aps/rest/portal/version/ 


[GET] [POST] 


Using the Version API you can find out the installed version of Portal and its 
sub-modules that are available in your subscription. 


Sample XML 


API request 


curl -u "USERNAME:PASSWORD" -X "GET" -H "Accept: application/xml" 
https://qualysapi.qualys.com/qps/rest/portal/version 


Response 


<?xml version="1.0" encoding="UTF-8"?> 
«ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/xsd/ve 
rsion.xsd"» 
«responseCode»SUCCESS«/responseCode» 
«count»1«/count» 
«data» 
«Portal-Version» 
«PortalApplication-VERSION»3.1.2.0-2 OFFICIAL #597 (2020- 
09-15T15:54:59Z)«/PortalApplication-VERSION» 
<ITAM-VERSION>1.2.0.0-1</ITAM-VERSION> 
«CS-VERSION»1.6.8.0-36«/CS-VERSION» 
«CA-VERSION»2.23.0.0«/CA-VERSION» 
«QGS-VERSION»1.2.0.0-6«/QGS-VERSION» 
«QUESTIONNAIRE-VERSION»2.23.1.0«/QUESTIONNAIRE -VERSION» 
«WAF-VERSION»2.12.4.0«/WAF-VERSION» 
<QUESTIONNAIRE V2-VERSION»1.10.1.0«/QUESTIONNAIRE V2- 
VERSION» 
<WAS-VERSION>6.13.1.0</WAS-VERSION> 
<FIM-VERSION>2.3.1.1</FIM-VERSION> 
«VM-VERSION»1.0.3«/VM-VERSION» 
«CERTVIEW-VERSION»2.6.0.2-7«/CERTVIEW-VERSION» 
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<CLOUDVIEW-VERSION>1.10.0.0-3</CLOUDVIEW-VERSION> 
<CM-VERSION>1.30.0.0</CM-VERSION> 
«MDS-VERSION»2.15.7.0«/MDS-VERSION» 
«PM-VERSION»1.4.2.3-3«/PM-VERSION» 
«PS-VERSION»1.2.0.0-RELEASE«/PS-VERSION» 
<THREAT | PROTECT-VERSION»1.2.0.0«/THREAT. PROTECT-VERSION> 
<UD-VERSION>0.0.6</UD-VERSION> 

</Portal-Version> 

<QWeb-Version> 
<WEB-VERSION>10.3.0.2-2</WEB-VERSION> 
<SCANNER-VERSION>12.1.67-1</SCANNER-VERSION> 
<VULNSIGS-VERSION>2.4.990-2</VULNSIGS-VERSION> 

</QWeb-Version> 

</data> 
</ServiceResponse> 


Sample JSON 


API request 


curl -u "USERNAME: PASSWORD" -X "GET" -H "Accept: application/json" 
https://qualysapi.qualys.com/qps/rest/portal/version 


Response 
it 


"ServiceResponse": 4 
"responseCode": "SUCCESS", 
"data": [ 
{ 
"Portal-Version": { 
"PortalApplication-VERSION": "3.1.2.0-2 OFFICIAL 
#597 (2020-09-15T15:54:59Z)", 

"ITAM-VERSION": "1 
"CS-VERSION": "1.6. 
"CA-VERSION": "2.23. o. 
"QGS-VERSION": "1.2.0. r 
" QUESTIONNAIRE -VERSION" : RDSI 
"WAF-VERSION": "2.12.4.0", 
"QUESTIONNAIRE V2-VERSION": "1.10.1.0", 
"WAS-VERSION": "6.13.1.0", 
"FIM-VERSION": "2.3.1.1", 
"VM-VERSION": "1.0.3", 
"CERTVIEW-VERSION": "2.6.0.2-7", 
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"CLOUDVIEW-VERSION": "1.10.0.0-3", 
"CM-VERSION": "1.30.0.0", 
“MDS=VERSION“: 72.15.70, 
"PM-VERSION": "1.4.2.3-3", 
"PS-VERSION": "1.2.0.0-RELEASE", 
"THREAT_PROTECT-VERSION": "1.2.0.0", 
"UD-VERSION": "0.0.6" 


"QWeb-Version": 4 


"WEB-VERSION": "10.3.0.2-2", 
"SCANNER-VERSION": "12.1.67-1", 
"VULNSIGS -VERSION": "2.4.990-2" 
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Output pagination and truncation 


The XML output of a search API request is paginated and the default page 
size is 100 object records. The page size can be customized to a value 
between 1 and 1,000. If the number of records is greater than the page size 
then the <ServiceResponse> element shows the response code SUCCESS with 
the element <hasMoreRecords>true</hasMoreRecords> as shown below. 


Follow the simple process below to obtain the first two the XML pages for an 
API request. Please apply the same logic to get all the next (n+1) pages until 
all records are returned. This is indicated when 
<hasMoreRecords>false</hasMoreRecords>. 


Step 1 - Search alerts and get first batch of results 


Search for alerts for the IP address 10.10.30.70. The service request in the 
POST data file “file.xml” defines this search criteria. 


API request 


curl -u "USERNAME: PASSWORD" -H “content-type: text/xml" -X "POST" 
--data-binary @- 
"https://qualysapi.qualys.com/qps/rest/1.0/search/cm/alert" < file.xml 
Note: “file.xml” contains the request POST data. 


Request POST data 


<ServiceRequest> 
<preferences> 
<limitResults>5</limitResults> 
</preferences> 
<filters> 
<Criteria field="ipAddress" 
operator="EQUALS"»10.10.30.70«/Criteria» 
«/filters» 
«/ServiceRequest» 


Response 
«ServiceResponse ...» 
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«responseCode»SUCCESS«/responseCode» 
«COUNT»5«/COUNT» 
«hasMoreRecords»true«/hasMoreRecords» 
«lastId»123«/lastId» 
«data» 
«!--here you will find 5 alert records--» 

«/data» 

«/ServiceResponse» 


Step 2 - Search alerts and get next batch of results 


To get the next page of results, you need to edit your service request in 
“file.xml” that will be passed to API request as a POST payload. According to 
the <lastid> element returned in the first page, you want the next page of 
results to start with the object ID 124 or greater. 


API request 


curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST" 
--data-binary @- 

"https: //qualysapi.qualys.com/qps/rest/1.0/search/cm/alert" < file.xml 
Note: “file.xml” contains the request POST data. 


In request POST data you'll notice the operator field value is set to 123, which 
is the value returned in <lastid> of the previous page output. The GREATER 
operator is a logical “greater than” (it does not Mean greater than or equal 
to). 


Request POST data 


«ServiceRequest» 
«filters» 
«Criteria field="ipAddress" 
operator="EQUALS"»10.10.30.70«/Criteria» 
«Criteria field="id" operator="GREATER"»123«/Criteria» 
«/filters» 
«/ServiceRequest» 


Set custom page size 


Qualys Continuous Monitoring API 
Get Started 


The service request needs to contain the <preferences> section with the 
<limitResults> parameter. For the <limitResults> parameter you can enter a 
value from 1 to 1,000. 


Response 


<ServiceRequest> 
<filters> 
<Criteria> ... </Criteria> 
</filters> 
<preferences> 
<limitResults>200</limitResults> 
</preferences> 
</ServiceRequest> 
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Available operators 


Operators supported by input parameters: 

Integer - EQUALS, NOT EQUALS, GREATER, LESSER, IN 
Text - CONTAINS, EQUALS, NOT EQUALS 

Date - EQUALS, NOT EQUALS, GREATER, LESSER 
Keyword - EQUALS, NOT EQUALS, IN 


Boolean (true/false) - EQUALS, NOT EQUALS 
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JSON support 


Qualys Continuous Monitoring API supports JSON requests and responses. 
Headers used in samples: 
Send JSON request - "Content-Type: application/json” 


Get response in JSON - "Accept: application/json” 


Sample 1 - Get profile 


API request 


curl -s -k -H "Accept: application/json" -n -u "acme ss2:passwd" 
"https: //qualysapi.qualys.com/qps/rest/1.0/get/cm/profile/95091" 


XML output 
1 
"ServiceResponse" : { 
«data= Sup 
"Profile" : { 

"title" : "NEW-Profile-12144557", 

"dateCreated" : "2018-09-12T22:46:10Z", 

"ruleset" : 4 
"dateUpdated" : "2018-09-12T22:45:35Z", 
"isTemplate" : "false", 
"title" : "NEW-CM-RULE-003-12144533", 
"description" : "Smoke test", 
"id" 188202; 
"dateCreated" : "2018-09-12T22:45:35Z" 

h 

"targetList" : "10.10.26.252", 

"dateUpdated" : "2018-09-12T22:46:10Z", 

"id" : 95001, 

"uuid" : "@8ed679e-9a6Ff -4ead-8290-185d51a188a2", 

"frequency" : “FREQ NEVER", 

"isActive" : "true", 

“includedips” : “10.10.26.252” 

} 
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F do 
“coque” 6 al, 
"responseCode" : "SUCCESS" 


} 
I 


Sample 2 - Search for rule 


API request 


cat searchRule.json | curl -s -k -X POST -H "Accept: application/json" 
-H "Content-Type: application/json" -H "user: acme ss2" -H "password: 
passwd" -d @- 

"https: //qualysapi.qualys.com/qps/rest/1.0/search/cm/rule" 


Request POST data 


{ 
"ServiceRequest": 1 
“rilters': E 
criteria dl 
=prield?: "rde. 
"operator": "EQUALS", 
"value": "179201" 
hí 
"field": "ruleType", 
"operator": "EQUALS", 
"value": "HOST" 
}] 
) 
) 
) 
XML output 
{ 
"ServiceResponse" : { 
"data" : [ { 
"Rule" : { 
wid! = 702015 
"ruleType" : "HOST", 
"dateCreated" : "2018-09-20T20:15:29Z", 
"jsonData" : 


"{\"ruleType\":\"HOST\", \"eventTypes\":[\"HOST_FOUND\"], \"criteria\":[ 
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], \"uiState\":{\"eventType.HOST_FOUND\": \"on\",\"operatingSystemType\" 
:\"\",\"operatingSystemValue\":\"\",\"hostnameType\":\"\", \"hostnameVa 
lue\":\"\", \"netbiosNameType\":\"\", \"netbiosNameValue\":\"\"}}", 


"eventTypes" : "HOST FOUND", 
"criteria" : { 
ls Al 
Í 
} 
} de 
SOL 
"hasMoreRecords" : "false", 
"responseCode" : "SUCCESS" 
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Alerts 


Search alerts 
/aps/rest/1.0/search/cm/alert/ 


[POST] 


Returns a list of alerts in the user's account. 

Limit your results - Use the optional “fields” parameter to limit the amount of 
information returned for each alert. Learn more about limiting your results 
Input Parameters 

Allowed input elements are listed below. The associated data type for each 
element appears in parentheses. These elements are optional and act as 
filters. When multiple elements are specified, parameters are combined using 


a logical AND. 


Click here for available operators 


Parameter Description 

id Cinteger) The alert ID. This element is assigned by the service. 
eventType The type of event that triggered the alert: 
(keyword) 


HOST_FOUND, HOST_UPDATED, HOST_PURGED, 
PORT_OPEN, PORT_CHANGED, PORT_CLOSED, 
SOFTWARE_ADDED, SOFTWARE_REMOVED, 

SSL NEW, SSL EXPIRED, SSL EXPIRY, 

TICKET. OPEN, TICKET. RESOLVED, TICKET CLOSED, 
VULN OPEN, VULN CLOSED, VULN REOPENED, 
VULN ACTIVE, VULN PREDICTION ADDED, 

VULN PREDICTION CHANGED, 

VULN PREDICTION CLOSED 
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ipAddress (text) The impacted host’s IP address. 
hostname (text) The impacted host’s hostname. 
isHidden Indicates whether the alert has been hidden from view. 
(boolean) Possible values: true or false 
eventDate The date of the event that triggered the alert in UTC 
(date) date/time format (YYYY-MM-DDTHH:MM:SSZ). 


alertDate (date) The date of the alert in UTC date/time format (YYYY- 
MM-DDTHH:MM:SSZ). 


profileTitle The name of the monitoring profile that resulted in the 
(text) alert. 


Sample - Search alerts 


API request 


curl -u "USERNAME: PASSWORD" -H "content-type: text/xml" -X "POST" -- 
data-binary @- 

"https: //qualysapi.qualys.com/qps/rest/1.0/search/cm/alert/" < 
file.xml 


Request POST data 


«ServiceRequest» 
«filters» 

«Criteria field="ipAddress" 
operator="EQUALS"»10.10.30.70«/Criteria» 
«/filters» 
«/ServiceRequest» 


Response 


«?xml version="1.0" encoding="UTF-8"?» 
«ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/ 
xsd/1.0/cm/alert.xsd"» 

«responseCode»SUCCESS«/responseCode» 
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<count>1</count> 
<hasMoreRecords>false</hasMoreRecords> 
<data> 
<Alert> 
<id>244402</id> 
<source>REMEDIATION</source> 
<eventType>SSL_NEW</eventType> 
<triggerUuid>3d41baf9-7caa-4269-9889-d7377aeaace5</triggerUuid> 
<ipAddress>10.10.30.70</ipAddress> 
<hostname>2k3-sp2-25-69.qualys.com</hostname> 
«eventDate»2018-06-04T10:57:43Z«/eventDate» 
«alertDate»2018-06-04T10:57:48Z«/alertDate» 
«isHidden»true«/isHidden» 
«profile» 
«id»7401«/id» 
«title»All Critical«/title» 
«dateCreated»2018-09-16T19:54:48Z«/dateCreated» 
<dateUpdated>2018-09-16T19:54:48Z</dateUpdated> 
<frequency>FREQ NEVER</frequency> 
<isActive>true</isActive> 
<includedIps>10.10.10.1-10.10.31.255</includedIps> 
<targetList>10.10.10.1-10.10.31.255</targetList> 
</profile> 
<alertInfo> 
<port>0</port> 
«sslName»2k3-sp2-25-69.qualys.com«/sslName» 
«sslIssuer»2k3-sp2-25-69.qualys.com«/sslIssuer» 
«/alertInfo» 
«/Alert» 
«/data» 
«/ServiceResponse» 


XSD 


«platform API server>/qps/xsd/1.0/cm/alert.xsd 
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View alert details 
/aps/rest/1.0/get/cm/alert/<id> 


[GET] [POST] 


Returns details for an alert. Want to find the alert ID to use as input? See 
Search alerts. 


Input Parameters 


The element “id” (integer) is required, where “id” identifies the alert. 


Sample - Get alert details 


API request 


curl -u "USERNAME : PASSWORD" 
"https: //qualysapi.qualys.com/qps/rest/1.0/get/cm/alert/246213" 


Response 


<?xml version="1.0" encoding="UTF-8"?> 
«ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/ 
xsd/1.0/cm/alert.xsd"> 
<responseCode>SUCCESS</responseCode> 
<count>1</count> 
<data> 
<Alert> 
<id>246213</id> 
<source>REMEDIATION</source> 
<eventType>HOST UPDATED</eventType> 
<triggerVuid>3d41baf9-7caa-4269-9889-d7377aeaace5</triggerVuid> 
«ipAddress»10.10.30.240«/ipAddress» 
«hostname»win12-30-240«/hostname» 
«eventDate»2018-06-04T18:11:54Z«/eventDate» 
«alertDate»2018-06-04T18:11:59Z«/alertDate» 
«isHidden»false«/isHidden» 
«profile» 
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<id>7401</id> 
«title»All Critical</title> 
<dateCreated>2018-09-16T19:54:48Z</dateCreated> 
<dateUpdated>2018-09-16T19:54:48Z</dateUpdated> 
«frequency»FREQ NEVER«/frequency» 
«isActive»true«/isActive» 
«includedIps»10.10.10.1-10.10.31.255«/includedIps» 
«targetList»10.10.10.1-10.10.31.255«/targetList» 
«/profile» 
«alertInfo» 
«operatingSystem»Windows Server 2012 Standard 64 bit 
Edition«/operatingSystem» 
<port>0</port> 
«/alertInfo» 
«/Alert» 
«/data» 
«/ServiceResponse» 


XSD 


«platform API server>/qps/xsd/1.0/cm/alert.xsd 
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Download alerts 
/qps/rest/1.0/download/cm/alert/?format=«format» 


[POST] 


Download a list of alerts in CSV or CEF format. 


Limit your results - Use the optional “fields” parameter to limit the amount of 
information returned for each alert. Learn more about limiting your results 


Input Parameters 


The element “format” (text) is required, where “format” is the file format (CSV 
or CEF). 


Allowed input elements are listed below. The associated data type for each 
element appears in parentheses. These elements are optional and act as 
filters. When multiple elements are specified, parameters are combined using 
a logical AND. 


Click here for available operators 


Parameter Description 

id (integer) The alert ID. This element is assigned by the service. 
eventType The type of event that triggered the alert: 
(keyword) 


HOST. FOUND, HOST. UPDATED, HOST. PURGED, 
PORT. OPEN, PORT. CHANGED, PORT, CLOSED, 
SOFTWARE ADDED, SOFTWARE REMOVED, 

SSL NEW, SSL EXPIRED, SSL EXPIRY, 

TICKET. OPEN, TICKET. RESOLVED, TICKET. CLOSED, 
VULN OPEN, VULN CLOSED, VULN REOPENED, 
VULN ACTIVE, VULN PREDICTION ADDED, 

VULN PREDICTION CHANGED, 

VULN PREDICTION. CLOSED 
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ipAddress (text) The impacted host’s IP address. 
hostname (text) The impacted host’s hostname. 
isHidden Indicates whether the alert has been hidden from view. 
(boolean) Possible values: true or false 
eventDate The date of the event that triggered the alert in UTC 
(date) date/time format (YYYY-MM-DDTHH:MM:SSZ). 


alertDate (date) The date of the alert in UTC date/time format (YYYY- 
MM-DDTHH:MM:SSZ). 


profileTitle The name of the monitoring profile that resulted in the 
(text) alert. 


Sample - Download alerts 


API request 


curl -u "USERNAME: PASSWORD" -H "content-type: text/xml" -X "POST" -- 
data-binary @- 

"https: //qualysapi.qualys.com/qps/rest/1.0/download/cm/alert/? format=c 
ef" « file.xml 


Request POST data 


«ServiceRequest» 
«filters» 
«Criteria field="eventType" operator="EQUALS"»PORT OPEN«/Criteria» 
«/filters» 
«/ServiceRequest» 


Sample CEF Output 


Jun 06 2017 15:43:9 83306MM.local 10.40.2.210 
CEF:0|QUALYS|QualysGuard|CM-1.4|PORT|PORT OPEN|O|cat=PORT 
dhost=2k8core-30-21.2k864sp0.qualys.com dst=10.10.30.21 dmac=NA 
dntdom=2K8CORE-30-21 rt=Nov 05 2017 15:57:21 
csloperatingSystem=Windows 2008 Enterprise Server Service Pack 2 
dpt=61466 cs2protocol=udp cs3defaultService=NA 
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CEF:0|QUALYS |QualysGuard|CM-1.4|PORT|PORT OPEN|O|cat=PORT 
dhost=2k8core-30-21.2k864sp0.qualys.com dst=10.10.30.21 dmac=NA 
dntdom=2K8CORE-30-21 rt=Nov 05 2017 15:57:21 
csloperatingSystem=Windows 2008 Enterprise Server Service Pack 2 
dpt=61466 cs2protocol=udp cs3defaultService=NA 

CEF:0|QUALYS |QualysGuard|CM-1.4|PORT|PORT OPEN|O|cat=PORT dhost=xp-30- 
32.qualys.com dst=10.10.30.32 dmac=NA dntdom=XP-30-32 rt=Nov 21 2017 
19:42:56 csloperatingSystem=Windows XP dpt=445 cs2protocol=tcp 
cs3defaultService=microsoft-ds 


Sample CSV Output 
"AlertId","Event Type", "ProfileId","Profile Name", "IP 


Address", "Hostname","Operating System", "Event Date", "Alert Date" 
"237124" , "PORT_OPEN", "7401", ALI Critical, 10.10. 30-21". 2k8core-30- 
21.2k864sp0.qualys.com","-","2017-12-31 15:57:21", "2017-12-31 

15:57: 225 

"237172","PORT_OPEN","5601","My Profile","10.10.30.21","2k8core-30- 
21.2k864sp0.qualys.com","-","2017-12-31 15:57:21","2017-12-31 
1525/7223" 

"238503 , PORT OPEN", 7401 , All Critical’, 10.10.30.32°, xp-30- 
32.qualys.com","-", "2017-01-16 19:42:56","2017-01-16 19:42:58" 
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Profiles 


Search profiles 
/aps/rest/1.0/search/cm/profile/ 


[POST] 


Returns a list of monitoring profiles in the user's account. 

Limit your results - Use the optional “fields” parameter to limit the amount of 
information returned for each profile. Learn more about limiting your results 
Input Parameters 

Allowed input elements are listed below. The associated data type for each 
element appears in parentheses. These elements are optional and act as 
filters. When multiple elements are specified, parameters are combined using 


a logical AND. 


Click here for available operators 


Parameter Description 

id Cinteger) The monitoring profile ID. This element is assigned by 
the service. 

title (text) The name of the monitoring profile. 

uuid (integer) The monitoring profile UUID. This element is assigned 


by the service. 


frequency The notification frequency setting defined in the 
(keyword) profile: 


FREQ NEVER, FREQ 5 MINUTES, 
FREQ 20 MINUTES, FREQ 1 HR, FREQ 2 HRS, 
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FREQ 6 HRS, FREQ 12 HRS, FREQ WEEKLY, 
FREQ DAILY 
isActive Is the monitoring profile active? (true or false). 
(boolean) 
ruleSetTitle The name of the ruleset assigned to the monitoring 
(text) profile. 


Sample - Search profiles 


API request 


curl -u "USERNAME: PASSWORD" -H "content-type: text/xml" -X "POST" 
--data-binary @- 
"https://qualysapi.qualys.com/qps/rest/1.0/search/cm/profile/" < 
file.xml 


Request POST data 


<ServiceRequest> 
<filters> 

<Criteria field="ruleSetTitle" 
operator="CONTAINS"»critical«/Criteria» 
«/filters» 
«/ServiceRequest» 


Response 


«?xml version="1.0" encoding="UTF-8"?» 
«ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/xsd/1. 
0/cm/profile.xsd"» 
«responseCode»SUCCESS«/responseCode» 
«count»1«/count» 
«hasMoreRecords»false«/hasMoreRecords» 
«data» 
«Profile» 
«id»7401«/id» 
«title»All Critical«/title» 
«uuid»d7af450c-828c-4101-a653-737f10d596c6«/uuid» 
<dateCreated>2018-09-16T19:54:48Z</dateCreated> 
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«dateUpdated»2018-09-16T19:54:48Z«/dateUpdated» 
«frequency»FREQ NEVER«/frequency» 
<isActive>true</isActive> 
<includedIps>10.10.10.1-10.10.31.255</includedIps> 
<targetList>10.10.10.1-10.10.31.255</targetList> 
<ruleset> 
<id>4001</id> 
<title>All Critical</title> 
<description>Critical security risks to be addressed 
immediately.</description> 
<dateCreated>2018-09-16T19:36:10Z</dateCreated> 
<dateUpdated>2018-09-16T19:36:10Z</dateUpdated> 
<isTemplate>false</isTemplate> 
</ruleset> 
</Profile> 
</data> 
</ServiceResponse> 


XSD 
<platform API server>/qps/xsd/1.0/cm/profile.xsd 
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View profile details 
/aps/rest/1.0/get/cm/profile/<id> 


[GET] [POST] 


Returns details for a profile. Want to find the profile ID to use as input? See 
Search profiles. 


Input Parameters 


The element “id” (integer) is required, where “id” identifies the profile. 


Sample - Get profile details 


API request 


curl -u "USERNAME : PASSWORD" 
"https: //qualysapi.qualys.com/qps/rest/1.0/get/cm/profile/7401" 


Response 


<?xml version="1.0" encoding="UTF-8"?> 
<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/xsd/1. 
0/cm/profile.xsd"» 
«responseCode»SUCCESS«/responseCode» 
«count»1«/count» 
«data» 
«Profile» 
«id»7401«/id» 
«title»All Critical«/title» 
«uuid»d7af450c-828c-4101-a653-737f10d596c6«/uuid» 
<dateCreated>2018-09-16T19:54:48Z</dateCreated> 
<dateUpdated>2018-09-16T19:54:48Z</dateUpdated> 
<frequency>FREQ NEVER</frequency> 
<isActive>true</isActive> 
<includedIps>10.10.10.1-10.10.31.255</includedIps> 
<targetList>10.10.10.1-10.10.31.255</targetList> 
<ruleset> 
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<id>4001</id> 
<title>All Critical</title> 
<description>Critical security risks to be addressed 

immediately.</description> 
<dateCreated>2018-09-16T19:36:10Z</dateCreated> 
<dateUpdated>2018-09-16T19:36:10Z</dateUpdated> 
<isTemplate>false</isTemplate> 

</ruleset> 
</Profile> 
</data> 
</ServiceResponse> 


XSD 


<platform API server>/qps/xsd/1.0/cm/profile.xsd 
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Search rules 
/aps/rest/1.0/search/cm/rule/ 


[POST] 


Returns a list of rules (which are part of rulesets) in the user's account. 

Limit your results - Use the optional “fields” parameter to limit the amount of 
information returned for each rule. Learn more about limiting your results 
Input Parameters 

Allowed input elements are listed below. The associated data type for each 
element appears in parentheses. These elements are optional and act as 
filters. When multiple elements are specified, parameters are combined using 


a logical AND. 


Click here for available operators 


Parameter Description 

id Cinteger) The rule ID. This element is assigned by the service. 
ruleType The type of rule: 

(keyword) 


HOST, VULN, PORT, SSL, SW 


Sample - Search rules 


API request 


curl -u "USERNAME:PASSWORD" -H “content-type: text/xml" -X "POST" -- 
data-binary @- 
"https: //qualysapi.qualys.com/qps/rest/1.0/search/cm/rule/" < file.xml 
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Request POST data 


<ServiceRequest> 
<filters> 
<Criteria field="ruleType" operator="EQUALS">HOST</Criteria> 
</filters> 
</ServiceRequest> 


Response 


<?xml version="1.0" encoding="UTF-8"?> 
«ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/xsd/1. 
0/cm/rule.xsd"» 

«responseCode»SUCCESS«/responseCode» 

«count»19«/count» 

«hasMoreRecords»false«/hasMoreRecords» 

«data» 

«Rule» 

«id»1413«/id» 

«ruleType»HOST«/ruleType» 

«eventTypes»HOST FOUND, HOST UPDATED«/eventTypes» 
<jsonData>{&quot; ruleTypeŝquot; :&quot; HOST&quot; ,&quot ;eventTypes&quot 
3: [&quot; HOST_FOUND&quot ; 

, &quot ; HOST UPDATED8quot; ],&quot; criteriaŝquot; :[{&quot; propertyName&q 
uot; :&quot;name&quot; ,&quot 
;propertyValue&quot ; :&quot; blah&quot; , &quot; expressionType&quot ; :&quot 
; EQUALS&quot ; +, 
{&quot ; propertyName&quot; :&quot;operatingSystemêquot;, &quot;propertyVa 
lueŝquot; :&quot ;blah&quot ; 
»&quot;expressionType&quot; : &quot ; EQUALS&quot ; +, {&quot ; propertyName&qu 
ot; :&quot ;hostname&quot ; 
,&quot ; propertyValue&quot ; :&quot;blah&quot;, &quot;expressionType&quot; 
:&quot ; EQUALS&quot ; }|}</jsonData> 
<dateCreated>2018-09-05T16:21:00Z</dateCreated> 
<criteria> 
<list> 

<RuleCriteria> 
<id>1437</id> 
«propertyName»name«/propertyName» 
«propertyValue»blah«/propertyValue» 
«expressionType»EQUALS«/expressionType» 

«/RuleCriteria» 

«RuleCriteria» 
«id»1439«/id» 
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<propertyName>operatingSystem</propertyName> 
<propertyValue>blah</propertyValue> 
<expressionType>EQUALS</expressionType> 
</RuleCriteria> 
pliso 
«/criteria» 
«/Rule» 
«/data» 
«/ServiceResponse» 


XSD 


«platform API server>/qps/xsd/1.0/cm/rule.xsd 
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View rule details 
/aps/rest/1.0/get/cm/rule/<id> 


[GET] [POST] 


Returns details for a rule. Want to find the rule ID to use as input? See Search 
rules. 


Input Parameters 


The element “id” Cinteger) is required, where “id” identifies the rule. 


Sample - Get rule details 


API request 


curl -u "USERNAME: PASSWORD" 
“https://qualysapi.qualys.com/gps/rest/1.0/get/cm/rule/6002" 


Response 


<?xml version="1.0" encoding="UTF-8"?> 
«ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xSi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/ 
xsd/1.0/cm/rule.xsd"> 
<responseCode>SUCCESS</responseCode> 
<count>1</count> 
<data> 
<Rule> 
<id>6002</id> 
<ruleType>VULN</ruleType> 
<eventTypes>VULN OPEN, VULN CLOSED, VULN ACTIVE, 
VULN REOPENED</eventTypes > 
<jsonData>(&quot; ruleType&quot; :&quot; VULN&quot; , &quot;eventTypes&quot 
3: [&quot; VULN OPEN&quot ; 
s&quot; VULN CLOSED&quot; , &quot; VULN ACTIVE&quot;,&quot;VULN REOPENED8q 
uot; ],&quot;criteria&quot ; 
:[]1,&quot ;uiState&quot; : (&quot;eventType.VULN OPEN&quot ; :&quot ; on&quot 
3, aquot; 
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eventType.VULN CLOSED&quot; :&quot;on&quot;,&quot;eventType.VULN ACTIVE 
&quot ; : &quot; on&quot; 
»&quot;eventType.VULN REOPENED&quot; :&quot;on&quot;,&quot;titleType&qu 
ot; :&quot;&quot;,&quot 
;titleValue&quot; :&quot;&quot;,&quot;qidType&quot; :&quot;&quot;, &quot; 
qidValueŝquot; :&quot; &quot; 
»&quot; cveType&quot ; :&quot; quot; , &quot; cveValue&quot; : &quot ; quot; }}< 
/jsonData> 
<dateCreated>2018-09-17T15:32:11Z</dateCreated> 
<criteria> 
<list/> 
</criteria> 
</Rule> 
</data> 
</ServiceResponse> 


XSD 
<platform API server>/qps/xsd/1.0/cm/rule.xsd 
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Search rulesets 
/aps/rest/1.0/search/cm/ruleset/ 


[POST] 


Returns a list of rulesets in the user's account. 

Limit your results - Use the optional “fields” parameter to limit the amount of 
information returned for each ruleset. Learn more about limiting your results 
Input Parameters 

Allowed input elements are listed below. The associated data type for each 
element appears in parentheses. These elements are optional and act as 
filters. When multiple elements are specified, parameters are combined using 


a logical AND. 


Click here for available operators 


Parameter Description 

id Cinteger) The ruleset ID. This element is assigned by the service. 
title (text) The name of the ruleset. 

description The user-provided description for the ruleset. 

(text) 

dateCreated The date the ruleset was created in UTC date/time 
(date) format (YYYY-MM-DDTHH:MM:SSZ). 

dateUpdated The date the ruleset was last updated in UTC 

(date) date/time format (YYYY-MM-DDTHH:MM:SSZ). 
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Sample - Search rulesets 


API request 


curl -u "USERNAME: PASSWORD" -H "content-type: text/xml" -X "POST"-- 
data-binary @- 
"https://qualysapi.qualys.com/qps/rest/1.0/search/cm/ruleset/" < 
file.xml 


Request POST data 


<ServiceRequest> 
<filters> 
«Criteria field="title" operator="CONTAINS"»critical«/Criteria» 
«/filters» 
«/ServiceRequest» 


Response 


««?xml version="1.0" encoding="UTF-8"?» 
«ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/ 
xsd/1.0/cm/ruleset.xsd"» 
«responseCode»SUCCESS«/responseCode» 
«count»1«/count» 
«hasMoreRecords»false«/hasMoreRecords» 
«data» 
«RuleSet» 
«id»4001«/id» 
«title»All Critical«/title» 
«description»Critical security risks to be addressed 
immediately.«/description» 
<dateCreated>2018-09-16T19:36:10Z</dateCreated> 
<dateUpdated>2018-09-16T19:36:10Z</dateUpdated> 
<isTemplate>false</isTemplate> 
<rule> 
<list> 
<Rule> 
<id>6001</id> 
<ruleType>HOST</ruleType> 
<eventTypes>HOST FOUND, HOST UPDATED, 
HOST PURGED</eventTypes> 
<jsonData>{&quot; ruleTypeŝquot; :&quot; HOST&quot; ,&quot ;eventTypes&quot 
3: [&quot; HOST FOUND&quot ; 
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»&quot ; HOST UPDATED8quot; ,ŝquot;HOST PURGEDSquot; ],&quot;criteria&quot 
;:[],@&quot;uiState&quot; 
:{&quot ;eventType.HOST_FOUND&quot ; : &quot ;on&quot ; , &quot ;eventType.HOST 
_UPDATED&quot ; : &quot; on&quot ; 
»&quot ;eventType.HOST_PURGED&quot ; :&quot;on&quot;, &quot;operatingSyste 
mType&quot ; : &quot ;&quot ; 
,»&quot ; operatingSystemValue&quot; :&quot;&quot; ,&quot ;hostnameType&quot 
3: &quot ;&quot; ,&quot; 
hostnameValue&quot; : &quot ;&quot; , &quot ;netbiosNameType&quot; : &quot ; Bou 
ot; ,&quot ;netbiosNameValue&quot ; 
:&quot ; &quot; }}</jsonData> 
<dateCreated>2018-09-17T15:32:10Z</dateCreated> 
</Rule> 
<Rule> 
<id>6002</id> 
<ruleType>VULN</ruleType> 
<eventTypes>VULN_OPEN, VULN_CLOSED, VULN_ACTIVE, 
VULN_REOPENED</eventTypes> 
<jsonData>{&quot ; ruleType&quot; : &quot ; VULN&quot; , &quot;eventTypes&quot 
3: [&quot; VULN OPEN&quot ; 
, &quot ; VULN_CLOSED&quot; , &quot ; VULN_ACTIVE&quot; , &quot ; VULN_REOPENED&q 
uot; ],&quot;criteria&quot ; 
:[],&quot ;uiState&quot; : {&quot;eventType.VULN OPEN&quot; :&quot ; on&quot 
;,&quot ;eventType.VULN CLOSED&quot ; 
:&quot ; on&quot; ,&quot;eventType.VULN_ACTIVE&quot; : &quot; on&quot;,&quot 
;eventType.VULN REOPENED&quot ; 
:&quot;on&quot;,&quot;titleType&quot;:&quot; &quot;,&quot;titleValue&qu 
ot; :&quot;&quot; , &quot; qidType&quot ; 
:&quot; &quot;, &quot; qidValue&quot; :&quot;&quot;, &quot; cveType&quot ; : &q 
uot;&quot;, &quot; cveValue&quot ; 
:&quot;&quot; }}</jsonData> 
«dateCreated»2018-09-17T15:32:11Z«/dateCreated» 
«/Rule» 
“lust 
«/rule» 
«/RuleSet» 
«/data» 
«/ServiceResponse» 


XSD 


«platform API server>/qps/xsd/1.0/cm/ruleset.xsd 
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View ruleset details 
/aps/rest/1.0/get/cm/ruleset/<id> 


[GET] [POST] 


Returns details for a ruleset. Want to find the ruleset ID to use as input? See 
Search rulesets. 


Input Parameters 


The element “id” (integer) is required, where “id” identifies the ruleset . 


Sample - Get ruleset details 


API request 


curl -u "USERNAME : PASSWORD" 
"https: //qualysapi.qualys.com/qps/rest/1.0/get/cm/ruleset/4001" 


Response 


<?xml version="1.0" encoding="UTF-8"?> 
<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xSi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/xsd/1. 
0/cm/ruleset.xsd"» 
«responseCode»SUCCESS«/responseCode» 
«count»1«/count» 
«data» 
«RuleSet» 
«id»4001«/id» 
«title»All Critical«/title» 
«description»Critical security risks to be addressed 
immediately.«/description» 
<dateCreated>2018-09-16T19:36:10Z</dateCreated> 
<dateUpdated>2018-09-16T19:36:10Z</dateUpdated> 
<isTemplate>false</isTemplate> 
<rule> 
<list> 
<Rule> 
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<id>6001</id> 
<ruleType>HOST</ruleType> 
<eventTypes>HOST FOUND, HOST UPDATED, 
HOST PURGED</eventTypes> 
<jsonData>{&quot;ruleType&quot; :&quot; HOST&quot; ,&quot ;eventTypes&quot 
3: [&quot; HOST FOUND&quot ; 
»&quot; HOST UPDATED&quot;,&quot;HOST PURGED&quot; ],&quot;criteria&quot 
3:.],&quot; uiState&quot ; 
:{&quot ;eventType.HOST_FOUND&quot; : &quot ;on&quot ; , &quot ; eventType. HOST 
_UPDATED&quot ` : &quot; on&quot ; 
»&quot;eventType.HOST PURGED&quot; : &quot ;on&quot; , &quot ; operatingSyste 
mType&quot ; :&quot;&quot ; 
,&quot ; operatingSystemValue&quot; :&quot; quot; , &quot ;hostnameType&quot 
3: &quot ;&quot; ,&quot 
;hostnameValue&quot ; :&quot; quot; , &quot; netbiosNameType&quot ; : &quot ; &q 
uot; ,8ŝquot;netbiosNameValueŝquot; 
:8 quot; &quot; }}</jsonData> 
<dateCreated>2018-09-17T15:32:10Z</dateCreated> 
</Rule> 
<Rule> 
<id>6002</id> 
<ruleType>VULN</ruleType> 
<eventTypes>VULN OPEN, VULN CLOSED, VULN ACTIVE, 
VULN REOPENED</eventTypes > 
<jsonData>{&quot ; ruleType&quot; :&quot; VULN&quot; , &quot;eventTypes&quot 
3: [&quot ; VULN OPEN&quot ; 
s&quot; VULN CLOSED&quot; , &quot ; VULN_ACTIVE&quot; ,ŝquot; VULN REOPENED8q 
uot; ],&quot;criteria&quot ; 
"TT, &quot ;uiState&quot; : {&quot;eventType.VULN OPEN&quot ; : &quot ; on&quot 
j &quot ;eventType.VULN CLOSED&quot ; 
:&quot ; on&quot; ,&quot ;eventType.VULN ACTIVE&quot; : &quot ; on&quot; ,&quot 
;eventType.VULN REOPENED&quot ; 
:&quot;on&quot; ,&quot ;titleType&quot ; :&quot;&quot;,&quot;titleValue&qu 
ot; :&quot ; quot; 
, &quot ; qidType&quot ; : &quot ; quot; , &quot ; qidValue&quot; :&quot;&quot; , &q 
uot ; cveType&quot ; :&quot;&quot ; 
»&quot; cveValue&quot ; :&quot ; quot; }}</jsonData> 
«dateCreated»2018-09-17T15:32:11Z«/dateCreated» 
«/Rule» 
«/list» 
«/rule» 
«/RuleSet» 
«/data» 
«/ServiceResponse» 
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XSD 


<platform API server>/qps/xsd/1.0/cm/ruleset.xsd 
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Troubleshooting 


Error Messages 


Error messages returned from CM API requests are described below by 


category. 


Error categories: Element | Criteria | Authorization 


Element 


Error Message 


<element>: 
Element must 
not be set. 


set: Element 
must contain at 
least one child. 


headers: Length 
of all headers 
cannot exceed 
2048 
characters. 


Criteria 


Error Message 


Criteria: Field is 
required. 


Resolution 


This element does not apply to this request. 


The set element requires at least one sub element. 


The values of all headers cannot exceed 2048 
characters. 


Resolution 


Specify the name of the criteria to search against. 
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Criteria: Invalid 
criteria (<field 
name>). 


Criteria: Invalid 
operator for 
criteria '«field»' 
(<operator>). 


Criteria: Value is 
required for 
criteria '«field»'. 


Criteria: Invalid 
value format for 
criteria '«field»': 
<value>. 


Authorization 


Error Message 


You are not 
authorized to 
access the 
application 
through the API. 


You do not have 
access to the 
module 
Continuous 
Monitoring 
required by this 
API. 


Qualys Continuous Monitoring API 
Troubleshooting 


Please search against one of the following criteria: %s. 


Allowed operations for this criteria are: %s. 


Specify a value for a field name for search criteria. 


Boolean (true, false). 
Date and Time in UTC format 
Enumeration (allowed options separated by comma). 


Other: Specify criteria value(s) as <type>. 


Resolution 


You must be granted the API Access permission in 
your roles and scopes. 


Please contact your account manager to have CM 
enabled in your subscription. 
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No data shall be 
passed for this 
operation. 


User is not 
authorized to 
perform this 
operation on 
specified 
object(s). 


Operation %s 
does not 
support search 
filters. 


Qualys Continuous Monitoring API 
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The POST request does not specify a data element. 


You must be granted access to these objects in your 
user scope. 


Do not provide search filters for this operation. 
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